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A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
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earned patent term adjustment. See 37 CFR 1.704(b). 
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2a)[3 This action is FINAL. 2b)D This action is non-final. 
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closed in accordance with the practice under Ex parte Quay/e, 1935 CD. 1 1 , 453 O.G. 213. 
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4) ^ Claim(s) 1-30 is/are pending in the application. 
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5) D Claim(s) is/are allowed. 

6) I3 Claim(s) 1-30 is/are rejected. 
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9) D The specification is objected to by the Examiner. 
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Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

11) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 
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Response to Amendment 

1. This action is responsive to amendment received on Dec. 1 , 2005. Claims 1-30 
are pending examination. 

Claim Rejections - 35 USC § 102 
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

2. Claims 1 , 3-4, 6-8, 27 and 30 are rejected under 35 U.S.C. 102(b) as being 
anticipated by Hekhuis, U.S. Patent No. 5,414,650. 

Hekhuis teaches the invention explicitly as claimed including a system and 
method for parsing incoming packets and classifying the packet flow (see abstract) 

As to claim 1 , Hekhuis teaches a method for identifying protocol encapsulation in 
received network data comprising providing language definition including a grammar for 
receiving incoming network data and processing it in accordance with a formal language 
processing technique using said language definition and said processing including 
parsing said network data using said grammar, said network data being organized into 
data packets (see col. 8 lines 55-col. 9 lines 37 and col. 10 lines 40-col. 11 lines 42, 
packets are parsed according to parsing rules to identify words where packets are 
classified accordingly). 

As to claim 3, Hekhuis teaches the method of claim 1 further including scanning 
said incoming network data using lexical token scanning to produce plural lexical 
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tokens, said step of parsing including parsing said lexical tokens (see col. 8 lines 55-col. 
9 lines 37 and col. 10 lines 40-col. 1 1 lines 42). 

As to claim 4, Hekhuis teaches the method of claim 3 wherein said lexical 
scanning includes providing a set of regular expressions (see col. 8 lines 55-col. 9 lines 
37 and col. 10 lines 40-col. 1 1 lines 42). 

As to claim 6, Hekhuis teaches a method for processing data packets 
comprising: 

providing a language definition including a grammar; 

receiving plural data packets, each having a length not necessarily equal 
to one another; and 

for each data packet, processing it according to a formal language 
processing technique using said language definition including lexically scanning said 
data packet to produce plural lexical tokens, parsing said lexical tokens using said 
grammar to produce one or more identified protocols, and processing said data packet 
based on said identified protocols (see col. 8 lines 55-col. 9 lines 37 and col. 10 lines 
40-col. 1 1 lines 42, packets are parsed according to parsing rules to identify words 
where packets are classified accordingly). 

As to claim 7, Hekhuis teaches the method of claim 6, including compiling said 
grammar to produce a grammar graph (see col. 8 lines 55-coL 9 lines 37 and col. 10 
lines 40-col. 1 1 lines 42). 
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As to claim 8, Hekhuis teaches the method of claim 7 wherein said lexical 
scanning includes providing regular expressions for identifying said lexical tokens (see 
col. 8 lines 55-col. 9 lines 37 and col. 10 lines 40-col. 1 1 lines 42). 

As to claim 27, Hekhuis teaches a network packet classifier comprising: means 
for receiving an incoming network packet; and 

means for identifying protocol structure in said network packet including means 
for processing said network packet in accordance with a formal language processing 
technique using, a language definition, including a step of scanning to match patterns in 
its constituent data against plural regular expressions to produce lexical tokens and 
means for parsing through said lexical tokens using a grammar, said regular 
expressions and said grammar being defined by said language definition (see col. 8 
lines 55-col. 9 lines 37 and col. 10 lines 40-col. 1 1 lines 42). 

As to claim 30, Hekhuis teaches the classifier of claim 27 wherein said regular 
expressions include arithmetic specifiers and said means for classifying includes an 
arithmetic logic unit configured to perform operations in accordance with said arithmetic 
specifiers (see col. 8 lines 55-col. 9 lines 37 and col. 10 lines 40-col. 1 1 lines 42). 

Claim Rejections - 35 (JSC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 
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3. Claims 2, 5, 9-1 1 , 12-26 and 28-29 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Hekhuis in view of Narad. 

As to claims 2, 5, 9, 10 and 12-13, Hekhuis teaches a method for classifying data 
packets comprising processing incoming network data with said language definition in 
accordance with a formal language processing technique including scanning said 
network data using lexical token scanning according to said language definition, 
wherein said network data is treated as a stream of input bytes, said network data being 
organized into data packets, said scanning resulting in the identification of a data packet 
as belonging to one of a plurality of classes (see col. 8 lines 55-col. 9 lines 37 and col. 
10 lines 40-col. 1 1 lines 42). 

Hekhuis does not explicitly teach the "providing a deterministic finite automaton 
DFA comprising plural states, said step of scanning including recognizing data packets 
using said DFA including transitioning from one state to another". 

However Narad teaches a method of parsing packets and generating DFA to 
identify a packet classification level (see col. 36 lines 19-col. 37 lines 22 and col. 103- 
col. 104). 

It would have been obvious for one of the ordinary skill in the art at the time of 
the invention to modify Hekhuis in view of including a DFA as taught by Narad. One 
would be motivated to include a DFA including recognizing the lexical tokens using the 
DFA in Riddle because doing so would allow the DFA to determine the classification of 
the data packet and map an ordered sequence of input events into a corresponding 
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sequence according to the control section of the data where the next state is uniquely 
determined by a single input event. 

As to claim 1 1 , Hekhuis teaches a method for processing data packets 
comprising: 

Receiving a description of grammar rules in the form of a grammar packet 
classification language; 

Compiling said grammar packet classification language to produce a grammar 

graph; 

Configuring a classifier with said grammar graph; 

Processing said data stream in accordance with a formal language processing 
technique using said grammar packet classification language including parsing said 
data stream with said grammatical packet classifier to identify a protocol structure in a 
received data packet; and 

Processing said received data packet in accordance with said protocol structure 
(see col. 8 lines 55-col. 9 lines 37 and col. 10 lines 40-col. 1 1 lines 42). 

As to claim 14, Hekhuis teaches the method of claim 12 wherein said lexical 
scanning includes providing a set of regular expressions (see col. 8 lines 55-col. 9 lines 
37 and col. 10 lines 40-col. 1 1 lines 42). 

As to claim 15, Hekhuis teaches the method of claim 14 wherein said regular 
expressions include arithmetic and logic operations (see col. 8 lines 55-col. 9 lines 37 
and col. 10 lines 40-col. 11 lines 42). 
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As to claim 16, Hekhuis teaches the method of claim 15 wherein said regular 
expressions further include skip operations (see col. 8 lines 55-col. 9 lines 37 and col. 
10 lines 40-col. 11 lines 42). 

As to claim 17, Hekhuis teaches the method of claim 16 wherein said regular 
expressions further include data storage operations (see col. 8 lines 55-col. 9 lines 37 
and col. 10 lines 40-col. 1 1 lines 42). 

As to claim 18, Hekhuis teaches a method for classifying data packets 
comprising processing incoming network data with said language definition in 
accordance with a formal language processing technique including scanning said 
network data using lexical token scanning according to said language definition, 
wherein said network data is treated as a stream of input bytes, said network data being 
organized into data packets, said scanning resulting in the identification of a data packet 
as belonging to one of a plurality of classes (see col. 8 lines 55-col. 9 lines 37 and col. 
10 lines 40-col. 1 1 lines 42). 

Hekhuis does not explicitly teach the "providing a deterministic finite automaton 
DFA comprising plural states, said step of scanning including recognizing data packets 
using said DFA including transitioning from one state to another". 

However Narad teaches a method of parsing packets and generating DFA to 
identify a packet classification level (see col. 36 lines 19-col. 37 lines 22 and col. 103- 
col. 104). 

It would have been obvious for one of the ordinary skill in the art at the time of 
the invention to modify Hekhuis in view of including a DFA as taught by Narad. One 
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would be motivated to include a DFA including recognizing the lexical tokens using the 
DFA in Riddle because doing so would allow the DFA to determine the classification of 
the data packet and map an ordered sequence of input events into a corresponding 
sequence according to the control section of the data where the next state is uniquely 
determined by a single input event. 

As to claim 1 9, Hekhuis teaches the classifier of claim 18 wherein some of said 
regular expressions include arithmetic instructions and logic instructions, said memory 
assemblage further configured to contain said instructions, the classifier further 
including an arithmetic logic unit operatively coupled to said decompression logic and 
configured to execute said instructions (see col. 8 lines 65-col. 9 lines 30 and col. 36 
lines 19-col. 37 lines 22). 

As to claim 20, Hekhuis teaches the classifier of claim 19 further including at 
least one register operatively coupled to said arithmetic logic unit, said arithmetic logic 
unit further configured to store data into said register in response to a save instruction 
(see col. 8 lines 55-col. 9 lines 37 and col. 10 lines 40-col. 1 1 lines 42). 

As to claim 21 , Hekhuis teaches the classifier of claim 19 further including skip 
logic operatively coupled to said logic component and configured to skip over an 
amount of data in response a skip instruction (see col. 8 lines 55-col. 9 lines 37 and col. 
10 lines 40-col. 1 1 lines 42). 

As to claim 22, Hekhuis teaches the classifier of claim 18 wherein said network 
data packets can vary from one packet to another (see col. 8 lines 55-col. 9 lines 37 and 
col. 10 lines 40-col. 11 lines 42). 
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As to claim 23, Narad teaches the classifier of claim 18 wherein said DFA is in 
compressed form (see col. 8 lines 65-col. 9 lines 30 and col. 36 lines 19-col. 37 lines 
22). 

As to claim 24, Narad teaches the classifier of claim 23 wherein said DFA 
comprises plural non-default states and plural default states, and said memory 
assemblage comprises a base memory, a next-state memory, and a default-state 
memory; said base memory configured to contain address locations of said next-state 
memory, said next-state memory representing all of said non-default states, said 
default-state memory representing all of said default states (see col. 8 lines 65-col. 9 
lines 30 and col. 36 lines 1 9-col. 37 lines 22). 

As to claim 25, Narad teaches the classifier of claim 24 wherein said memories 
are random access memories (see col. 42 lines 35-67). 

As to claim 26, Narad teaches the classifier of claim 24 wherein said memories 
are read only memories (see col. 42 lines 35-67). 

As to claim 28, Narad teaches the classifier of claim 27 wherein said means for 
scanning includes a memory component configured with data to represent a 
deterministic finite automaton (DFA) (see col. 8 lines 65-col. 9 lines 30 and col. 36 lines 
19-col. 37 lines 22). 

As to claim 29, Narad teaches the classifier of claim 28 wherein said memory 
component is further configured to include said grammar (see col. 8 lines 65-col. 9 lines 
30 and col. 36 lines 19-col. 37 lines 22). 

Response to Arguments 
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4. Applicant's arguments have been fully considered but are not persuasive. 
Applicant argues in substance that Hekhuis does not disclose parsing packets in 
accordance with a formal language. 

In response, Hekhuis teaches a system and method for parsing packets and 
classifying packets according to rules (see abstract). The system parses packets 
according to parsing rules. For example, the system may identify a packet as a cardinal 
packet by comparing the string identified from the packet to the set {"and", "br", "d", "f, 
"ing", "th"}. The matching of the string with the set {"and", "br", "d", "f , "ing", "th"} to 
identify a cardinal packet is interpreted by examiner to be the grammar used to parse 
the packets (see col. 8 lines 55-col. 9 lines 6). There is no limitation in the claim on the 
content on the grammar or how the grammar is being used to parse the packets and 
therefore Hekhuis parsing of packets by matching a string identified in a set meets the 
scope of the claim language "parsing said network data using said grammar". In 
addition, the received packets are compared to a dictionary i.e. "formal language", if the 
packet information is not in the dictionary, a token is assigned to the packet (see col. 12 
lines 52-col. 13 lines 5). Therefore Hekhuis's comparing of packet information to a 
dictionary and adding tokens to the packets in accordance with the comparison meets 
the scope of the claimed limitation "processing incoming network data in accordance 
with a formal language". 

5. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .1 36(a). 
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A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 
6. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Hussein A. El-chanti whose telephone number is 
(571)272-3999. The examiner can normally be reached on Mon-Fri 8:30-5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ario Etienne can be reached on (571 )272-4001 . The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
Hussein El-chanti 
Feb. 5, 2006 
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